It's because of "Not Invented Here" policies. I have seen some banks use 2FA for internal logins - Westpac uses RSA SecurID tokens.